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REMARKS 

The Applicants and the undersigned thank Examiner Cangialosi for his time and 
consideration given dnring the telephonic interview with the undersigned on August 2, 2005. 
The Applicants also thank Examiner Cangialosi for his careful review of this application. Claims 
1-59 have been rejected by the Examiner. Upon entiy of this amendment. Claims 1-59 remain 
pending in this application. The seven independent claims are Claims 1, 12, 23, 30, 39, 48, and 
57. 

Consideration of the present application is respectfully requested in light of the above 
amendments to the application and in view of the following remarks. 



Summary of Telephonic Interview of August 2> 2005 

The Applicants and the undersigned thank Examiner Cai^ialosi for his time and 
consideration given during the telephonic interview of August 2, 2005. During this telephonic 
interview, a proposed amendment to the claims was discussed. The Applicants provided the 
proposed amendment to the claims in advance of the interview. 

During the telephonic interview, it was explained to Examiner Cangialosi that the prior 
art of record does not provide any teaching of providing temporary authorization data for use 
with an authentication table that is associated with an information account. It was also explained 
that the prior art does not provide any authentication table to determine at least one of: whether a 
temporary authorization is being used by an authorized party who is not the consvimer, whether a 
temporary authorization has expired^ and what level of access to the information account is 
associated with a temporary authorization. See, for example^ amended independent Claims 1, 12, 
30, 39, 48, and 57. 

For independent Claim 23, it was explained that the prior art also does not provide any 
teaching of embedding the temporary authorization as a parameter in a uniform resource locator 
with an authentication module and redirecting the browser of the client device with a first server 
to a web page hosted by a second server and associated with a third-party using the \miform 
resource locator. The prior art also docs not teach subsequcntiy receiving a communication with 
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the first server from tiie second server hosting the web page comprising the ftuther request for 
access to the infoimation account along with the temporary authorization. And the prior art does 
not teach that in response to receiving the temporary authorization with the first server, 
authenticating the third-party with the authentication module to access the information account 
according to the access privileges associated with the temporary authorization. 

Examiner Cangialosi was asked by the undersigned if the proposed amendment to the 
claims overcame the rejection made by the Examiner under 35 U.S.C. §112, second paragraph* 
Examiner Cangiolosi told the undersigned flhat the claims should further describe the computer 
operating environment or computer context in order to overcome the rejection under 35 U,S.C. 
§112, second paragraph. The Applicants note that the claims as presented by this amendment 
include more context and the exemplary computer operating environment, as suggested by 
Examiner Cangialosi. 

The Applicants and the undersigned request the Examiner to review this interview 
summary and to approve it by writing "Interview Record OK" along with his initials and the date 
next to this summary in the margin as discussed in MPEP § 713.04, p. 700-202. Consideration 
and approval of this interview summary record are respectfijlly requested. 

Rejection under 35 U.S.C. $ 112. second paragraph 

The Examiner rejected Claims 1-59 under 35 U.S.C. § 112, second paragraph, as being 
indefinite for failing to particularly point out and distinctly claim the subject matter which the 
Applicant regards as the inventioa In response to this rejection, the Applicant have amended 
these claims in accordance with the Examiner's very helpfiil cotnments made in the Office 
Action and during the telephonic interview as discussed above. Reconsideration and vdthdrawal 
of these rejections are respectfully requested. 
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ReiectioM under 35 U.S.q S 103 

The Examiner has rejected Claims 1-59 under 35 U.S.C. § 103 as being unpatentable over 
the U.S. Patent No. 6,321,339 issued in the name of French et al. (hereinafter, the "French 
reference") in view of U.S. Patent No. 5,889,942 issued in the name of Orenshteyn (hereinafter, 
the "Orenshteyn reference*'). 

The Applicant respectfully offers remarks to traverse these rejections. The Applicant will 
address each independent claim separately as the Applicant believes that each independent claim 
is separately patentable over the prior art of record. 

Independent Claim 1 

The rejection of Claim 1 is respectftdly traversed. It is respectfully submitted that the 
French and Orenshteyn references fail to describe, teach, or suggest the combination of: (1) 
storing an information account in a central data repository that is accessible via a distributed 
computer network, (2) the information account containing consumer information elements that 
are changed by the consumer; (3) associating consumer authentication information with the 
information account using a server such that access to the information account by the consumer 
is conditioned upon receipt and verification of the consumer authentication information by the 
server; (4) further associating a temporary authorization with the information account using an 
authentication module running on the server, (5) the temporary authorization havmg consumer- 
defined attributes that define access privileges that wiU be granted to a person who presents the 
temporary authorization along with a request for access to the information account; (6) receiving 
the temporary autfiorization from the distributed computer network; (7) comparing the temporary 
authorization to data in an authentication table associated with the information account using the 
authentication module in order to determine at least one of: (7a) whether the temporary 
authorization is being used by an authorized party who is not the consumer, (7b) whether the 
temporary authorization has expired, and (7c) what level of access to the information account is 
associated vnih the temporary authorization; and (8) granting a level of access to the information 
account by the authentication module based on the temporary authorization if the temporary 
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authorization is found valid based on the comparing step, as recited in amended independent 
Claim 1. 

The French Reference 

The French reference describes a method for authenticating a user who wishes to apply 
for an on-line transaction. Such transactions can include for example, an electronic brokerage 
trade that is either carried out or not carried out depending on the results of the authentication 
process. The extent of authentication processing performed can depend upon the nature of the 
transaction and vendor-specific requirements. Once the authentication process has been satisfied, 
the technology described by the French reference may generate a digital certificate that contains 
authentication levels and other information related to a user. See the French reference. Col. 2, 
lines 30-48. 

The French reference explains that its technology has different levels of authentication to 
be performed based on the level of security desired for a particular on-line transaction. Lower 
risk transactions such as relatively small purchases may not requite an extensive authentication 
process. Meanwhile, more sensitive or greater risk transactions such as large purchases may 
require a more thorough authentication process and a greater level of certainty. See the French 
reference, Col. 2, lines 51 -65. 

The French reference explains that a user is authenticated according to their ability to 
respond to successive queries for personal information and the level of match attained fiom 
comparing the information they provide with reliable data sources. The user is initially requested 
to provide a first Qpe of identification information. The first ^e of mformation is preferably 
wallet-type information that includes information such as, name, address, driver's license or 
other information that may be commonly carried on the person. See steps 32 and 34 of Figure 1 
illustrated below in which a user is prompted to enter a first level of aufiientication. 
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The French reference does not provide any teaching of comparing a temporaxy 
authorization to data in an authentication table associated with the information account using an 
authentication module in order to determine at least one of: whether the temporary authorization 
is being used by an audiorized party who is not the consumer, whether the temporary 
authorization has expired, and what level of access to the information account is associated with 
the temporary authorization; and granting a level of access to the information account by the 
authentication module based on the temporaiy authorization if the temporary authorization is 
found valid based on the comparing step, as recited in amended independent Claim 1 . 
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The Orenshtevn Rcf crenoc 

The Exiaminer admits tibiat the French reference does not provide any teaching of a 
temporary authorization as claimed by flie Applicants. However, the Examiner relics upon the 
Qrenshteyn reference to provide a teaching of temporary authorizatiorL 

The Oreixshteyn reference explains that upon initiation by a client computer S, a selected 
server 7 as illustrated in Figure 1 starts a selected application running on the server 7 and the 
server 7 selectively accesses the file system and the corresponding data of a requesting client 5. 
The client 5 acts a peripheral device for the selected service application running remotely on the 
server 7. In turn, the remote server 7 processes the corresponding data from the client 5 through 
the started service application without permanently storing the data within the server 7. 

In other words, the client 5 provides the application program running on the server 7 with 
the file systems, screen, keyboards, mouse, and other attached devices to the client 5, while the 
server 7 provides running the application the logic and compute-power to the clients. See Figure 
1 illustrated below and CoL 4, lines 51-64 of the Qrenshteyn reference. 
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The Orenshteyn reference explains that its technology allows selected restricted access 
fifom the application running on the remote server 7 to the client's permanent storage facilities 
such as the hard drives^ CD-Rom drives, tape drives^ floppy drives, and any other VO or other 
device which may be attached to the client S. 

In other words, the remote server 7 perfonns operations on Ihe client's local data and 
devices. Thus, the server 7 can process the data from the client 5; however, the data never 
resides permanently on the server 7. Local data is simply read from or written to the client files 
system as required by the application logic running on the server 7. See the Orenshteyn reference 
Col. 5, lines 41-54. 

The Examiner relies upon step 100 of Figure 3B illxistrated below to provide a teaching of 
temporary authorization. The Orenshteyn reference explains that if the server 7 does not have 
authorization to access the files in the resource configuration file residing on a client 5, then the 
process proceeds to step 100 where the client user 5 chooses whether or not to grant a single \ise 
authorization for the server 7 to access the resource configuration file residing on the client's 
computer 5. 
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See Figure 3B, Step 100 of the Orenshteyn reference illustrated above. If the client user 
does grant authorization, then in step 105, the server application running on the server 7 is 
permitted to read, write, append, rename, move, or create the corresponding file in the file system 
residing on the client computer 5. 

This system described by the Orenshteyn reference is different from the Applicants' 
claimed invention in at least two aspects: (1) the client computer in the Orensheteyn reference 
controls the alleged '"temporary authorization"; and (2) the Orenshteyn reference does not 
provide any teaching of a temporary authorization table. 

Regarding the first difference, as noted above, the client computer of the Orensheteyn 
reference controls the alleged 'temporary authorization" to one or more files existing on the the 
client computer itself Meanwhile, the Applicants' invention uses an audientication module 
running on a server to compare a temporary authorization to data in an authentication table to 
control access to consumer information. One of ordinary skill in the art recognizes that the client 
computer access control of the Orenshteyn reference is substantially different from a server 
running an authentication module that uses an authentication table to allow access to an 
information account stored in a central data repositoiy. 

Regarding the second difference, like the French reference, the Orenshteyn reference does 
not provide any teaching of comparing a temporary authorization to data in an authentication 
table associated with the information account using the authentication module in order to 
determine at least one of: whether the temporary authorization is being used by an authorized 
party who is not the consumer, whether the temporary authorization has expired, md what level 
of access to the information account is associated with the temporary authorization; and granting 
a level of access to the information account by the authentication module based on the temporary 
authorization if the temporary authorization is found valid based on the comparing step, as 
recited in amended independent Claim 1 . 
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Conclusion Regarding Independent Claim 1 

In li^t of the differences between amended Claim I and the Fiench and Orensbteyn 
references mentioned above, one of ordinary skill in the art recognizes that the combination 
proposed by the Examiner cannot anticipate or render obvious the recitations as set forth in 
amended Independent Claim 1 . Accordingly, reconsideration and withdrawal of this rejection are 
respectfully requested. 

Indet)endent Claim 12 

The rejection of Claim 12 is respectfully traversed. It is respectfully submitted that the 
French and Orenshteyn references fell to describe, teach, or suggest the combination of: (1) 
presenting to a host server via a distributed computer network a request for access by a consumer 
to an information account along with consumer authentication information, (2) the information 
account being stored in a central data repository that is accessible by the host server via the 
distributed computer network, (3) the information account containing consumer information 
elements that are changed by the consumer; (4) receiving from the host server an 
acknowledgment that the consumer has been authenticated based on the consumer authentication 
information and thereby granted access to the information account; (5) in response to the 
acknowledgment, transmitting to the host server a request by the consumer for generation of a 
temporary authorization having consumer-defined attributes that define access privileges that are 
granted to a person who presents the temporary authorization along with a subsequent request for 
access to the information account; (6) receiving the temporary authorization fix>m the distributed 
computer network with an authentication module running on the host server; (7) comparing the 
temporary authorization to data in authentication table associated with the information account 
using the authentication module in order to determine at least one of: (7a) whetiier the temporary 
authorization is being used by an authorized party who is not the consumer, (7b) whether the 
temporary authorization has expired, and (7c) what level of access to the information account is 
associated with tiie temporary authorization; and (8) granting a level of access to the information 
account with the authentication module based on the temporary authorization if the temporary 
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authorization is found valid based on the comparing step, as recited in amended independent 
Claim 12. 

As noted in the discussion of Claim 1 above, neither the French or Orenshteyn references 
provide any teaching of a temporary authorization table. And it follows that neither reference 
provides any teachizxg of comparing a temporary authorization to data in an authentication table 
associated vvith the information account using the authentication module in order to determine at 
least one of: (a) whether the temporary authorization is being used by an authorized party who is 
not the consumer, (b) whether the temporary authorization has expired, and (c) ^^at level of 
access to the information account is associated with the temporary authorization. 

In light of the differences between amended Claim 12 and the French and Orenshteyn 
references mentioned above, one of ordinary skill in the art recognizes that the combination 
proposed by the Examiner cannot anticipate or render obvious the recitations as set forth in 
amended independent Claim 12. Accordingly, reconsideration and withdrawal of this rejection 
are respectfully requested. 

Independent Claim 23 

The rejection of Claim 23 is respectfully traversed. It is respectfully submitted that the 
French and Orenshteyn references fail to describe, teach, or suggest the combination of (1) 
receiving a request with a first server for access to an information account and consumer 
authentication information from a client device executing a browser, (2) the information account 
being stored in a central data repository and containing consumer information elements that are 
changed by the consumer, (3) authenticating the consumer with the first server to access the 
information account based on the consumer authentication information; (4) in response to 
authenticating the consumer by the first server to access the information account based on the 
consumer authentication information, generating a temporary authorization with an 
authentication module running on the first server having consumer-defined attributes that define 
access privileges that arc granted to an entity that presents the temporary authorization along with 
a further request for access to the information account; (6) embedding the temporary 
authorization as a parameter in a uniform resource locator with the authentication module and 
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redirecting the browser of the client device with the first server to a web page hosted by a second 
server and associated with a third-party using the uniform resource locator; (7) subsequently 
receiving a communication with the first server firom flie second server hosting the web page 
comprising the further request for access to the information account along with the temporary 
authorization; and (8) in response to receiving the temporary authorization with the first server, 
authenticating tihe third-party with the authentication module to access the information account 
according to the access privileges associated with the temporary authorization, as recited in 
amended independent Claim 23. 

Neither the French nor the Qrenshteyn references provide any teajching of embedding a 
temporary authorization as a parameter in a uniform resource locator with an authentication 
module and redirecting the browser of the client device with the first server to a web page hosted 
by a second server and associated with a third-party using the uniform resource locator. 

In light of the differences between amended Claim 23 and the French and Oienshteyn 
references mentioned above, one of ordinaiy skill in the art recognizes that the combination 
proposed by the Examiner cannot anticipate or render obvioxis the recitations as set forth in 
amended independent Claim 23. Accordingly, reconsideration and withdrawal of this rejection 
are respectfully requested. 

Independent Claim 30 

The rejection of Claim 30 is respectfully traversed. It is respectfully submitted that the 
French and Qrenshteyn references fail to describe, teach, or suggest the combination of (1) a 
central data repository accessible via a distributed computer network for storing an information 
account containing consumer information elements that are changed accessed, retrieved and 
altered by the consumer; (2) a communication device for receiving from the consumer via the 
distributed computer network consumer authentication information, (3) a request for a temporary 
authorization and consumer-defined attributes defining access privileges that are granted to a 
person who presents fte temporary authorization along with a request for further access to the 
information account; and (4) a processor configured for executing computer-executable 
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instructions for: (5) in response to receiving the consumer authentication information, accessing 
an authentication tahle to determine whether the consumer authentication information is 
associated with the information account, such that the consumer may be provided with access to 
the infoimation account, (6) in response to determining that the consumer authentication 
information is associated with the information account and in response to the request for the 
temporary authorimtion, generating the temporary authorization having the consumer-defined 
attributes; (7) receiving the temporary authorization from the distributed computer network; (8) 
comparing the temporary aufliorization to data in the authentication table associated with the 
uiformation account in order to determine at least one of: (8a) whether the temporary 
authorization is bemg used by at least one of an authorized person and authorized third-party v/ho 
is not the consumer, (8b) whether the temporary authorization has expired, and (8c) what level of 
access to the information account is associated with the temporary authorization; and (9) granting 
a level of access to the information account based on the temporary authorization if the 
temporary authorization is found valid based on the comparing step, as recited in amended 
independent Claim 30. 

As noted in the discussion of Claim 1 above, neither the French or Orenshteyn references 
provide any teaching of a temporary authorization table. And it follows that neither reference 
provides any teaching of comparing a temporary authorization to data in an authentication table 
associated with the information accoimt using the authentication module in order to determine at 
least one of: (a) whether the temporary authorization is being used by an authorized party who is 
not the consumer, (b) whether the temporary authorization has expired, and (c) what level of 
access to the information account is associated with the temporary authorization. 

In light of the differences between amended Claim 30 and the French and Orenshteyn 
references mentioned above, one of ordinary skill in the art recognizes that the combination 
proposed by the Examiner cannot anticipate or render obvious the recitations as set forth in 
amended independent Claim 30. Accordingly, reconsideration and withdrawal of this rejection 
are respectfully requested. 
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Independent fjlaim 39 

The rejection of Claim 39 is respectfully traversed. It is tespectfUlly submitted that the 
French and Orenshteyn references fail to describe, teach, or suggest the combination of: (1) 
storing the information account on a central data repository; (2) receiving with a server, over a 
distributed computer network^ requests from different network devices for access to the 
information account, (3) each of said requests comprising an authorization identifier; (4) in 
response to each of the requests, comparing each authorization identifier to data in an 
authentication table associated with the infoimation account using an authentication module 
running on the server in order to determine at least one of: (4a) whether the authorization 
identifier is being used by aii authorized party who is not the consumer, (4b) whether the 
authorization identifier has expired, and (4c) what level of access to the information account is 
associated with the authorization identifier; (5) if the comparing step is successful for a particular 
authorization identifier, then retrieving a set of authorization parameters associated with the 
particular authorization identifier using the authentication module, (6) said authorization 
parameters being defined by the entity whose information is stored in the information account; 
and (7) granting access to each of the network devices with the authentication module if the 
comparing step is successful and (8) in accordance with the authorization parameters retrieved in 
response to the network device's request, as recited in amended independent Claim 39. 

As noted in the discussion of Claim 1 above, neither the French or Orenshteyn references 
provide any teaching of a temporary authorization table. And it follows that neither reference 
provides any teaching of comparing a temporary authorization to data in an authentication table 
associated with the infonuation account using the authentication module in order to determine at 
least one of: (a) whether the temporary authorization is being used by an authorized party who is 
not the consumer, (b) whether the temporary authorization has expired, and (c) what level of 
access to the information account is associated with the temporary authorization. 

In light of the differences between amended Claim 39 and the French and Orenshteyn 
references mentioned above, one of ordinary skill in the art recognizes that the combination 
proposed by the Examiner cannot anticipate or render obvious the recitations as set forth in 
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amended independent Claim 39. Accordingly, reconsideration and withdrawal of this rejection 
are respectfully requested. 

Indeoendent Claim 48 

The rejection of Claim 48 i$ respectfully traversed. It is respectfully submitted that the 
French and Orenshteyn references fail to describe, teach, or suggest the combination of: (1) a 
data repository storing an information account; (2) a computer network interface for receiving, 
over a distributed computer network, (3) requests from different network devices for access to 
the information account, (4) each of said requests comprising an authorization identifier; and (5) 
a processor for comparing each authorization identifier to data in an authentication table 
associated with the information account in order to determine at least one of: (5a) whether the 
authorization identifier is being used by an authorized party who is not the entity whose 
information is stored in the information account, (5b) whether the authorization identifier has 
expired, and (5c) what level of access to the information account is associated with the 
authorization identifier, (6) said processor configured to retrieve a set of authorization parameters 
associated with the authorization identifier if a comparison between a respective authorization 
identifier and data in the authentication table is successful, (7) said processor granting access to 
each of the network devices in accordance with the authorization parameters retrieved in 
response to the networic device's request and if a comparison between a respective authorization 
identifier and data in the authentication table is successfiil; (8) wherein said authorization 
parameters are defined by the entity whose information is stored in the information account, as 
recited in amended independent Claim 48. 

As noted in the discussion of Claim 1 above, neither the French or Orenshteyn lefeitsnces 
provide any teaching of a tcmporaiy authorization table. And it follows tiiat neither reference 
provides any teaching of comparing a temporary authorization to data in an authentication table 
associated with the mformation account using the authentication module in order to determine at 
least one of: (a) whether the temporary authorization is being used by an authorized party who is 
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not the consumer^ (b) whether the temporary authorization has expired, and (c) what level of 
access to the information account is associated with the temporary authorization. 

In light of the difiGsrences between amended Claim 48 and the French and Otenshteyn 
references mentioned above, one of ordinary skill in tiie art recognizes that the combination 
proposed by the Examiner cannot anticipate or render obvious the recitations as set forth in 
amended independent Claim 48. Accordingly, reconsidnation and withdrawal of this rejection 
are respectAilly requested. 

Independent Claim 57 

The rejection of Claim 57 is respectfully traversed. It is respectfully submitted that the 
French and Orenshteyn references fail to describe, teach, or suggest the combination of: (1) 
storing data for a consumer information account: (2) providing an interface whereby an owner of 
the consimier information account can specify the tenns by which third parties can access the 
consumer information account; (3) storing the terms for future use in an authentication module of 
a server; (4) associating the stored terms with one or more authorization tickets; (5) transmitting 
the authorization tickets to specified third parties; (6) receiving the authorization tickets from a 
distributed computer network; (7) comparing the authorization tickets to data in the 
authentication table associated with the consumer information account using the authentication 
module in order to determine at least one of: (7a> whether the authorization ticket is being used 
by an authorized third-party who is not the consumer, (7b) whether the tcmporaiy authorization 
has expired, and (7c) what level of access to the information account is associated with the 
temporary authorization; and (8) granting a level of access to the consumer infonnation account 
based on the authorization ticket if the authorization ticket is found valid based on the comparing 
5tep» as recited in amended independent Claim 57. 

As noted in the discussion of Claim 1 above, neither the French or Orenshteyn references 
provide any teaching of a temporary authorization table. And it follows that neither reference 
provides any teaching of comparing a temporary audtiorization to data in an authentication table 
associated with the information account using the authentication module in order to determine at 
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least one of: (a) whether the temporazy authorization is being used by an authorized party who is 
not the consumer, (b) whether the temporary authorization has expired, and (c) what level of 
access to the infonnation account is associated with the temporary authorization. 

In light of the differences between amended Claim 57 and the French and Orenshteyn 
references mentioned above^ one of ordinary skill in the art recognizes that the combination 
proposed by the Examiner cannot anticipate or render obvious the recitations as set forth In 
amended independent Claim 57. Accordingly^ reconsideration and withdrawal of this rejection 
axe respectfully requested. 

Dependent Claims 2-11. 13-22. 24-29. 31-38. 40-47. 49-56. 58-59 

The Applicants respectfully submit that the above-identified dependent claims are 
allowable because the independent claims from which they depend are patentable over the cited 
references. The Applicants also respectfhlly submit that the recitations of these dependent claims 
are of patentable significance. 

In view of the foregoing, the AppHcants respectfully request that the Examiner withdraw 
the pending rejections of dependent Claims 2-11, 13-22. 24-29, 3 1-38, 40-47, 49-56, 58-59. 

CONCLUSION 

The foregoing is submitted as a full and complete response to the Office Action mailed 
on March 2, 2005. The Applicants and the undersigned thank Examiner Cangialosi for 
consideration of these remarks. The Applicants have amended the claims and have submitted 
remarks to traverse rejections of Claims 1-59. The Applicants respectfully submit that the 
present application is in condition for allowance. Such action is hereby courteously solicited. 
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If the Examiner believes that thete are any issues that can be resolved by a telephone 
conference, or ttxat there are any formalities that can be corrected by an Exatviner's amendment, 
please contact the midersigned in the Atlanta Metropolitan area (404) 572-2884. 



KING & SPALDING, LLP 

45*^ Floor, 191 Peachtree Street, N.E. 

Atlanta, Georgia 30303 

404.572.4600 

K&S Docket: 07258-105005 
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Respectfully submitted. 




